Lifecycle & Access Governance
Enable Account
Turn a disabled account back on, on the systems you pick, with a justification on the record.
Completes when the person's selected accounts are enabled: after approval, or at once when a workflow admin skips workflow.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Enable Account from the AI Assistant You Already Use
The approval workflow set up for each system decides who approves, with identity verification first in Avabot and MCP, where every enable is filed as an approval request. One completed account enable = one Secure Outcome; failed attempts are never billed.
You: Enable Dana Cruz's accounts again. Justification: back from extended leave. Avatier: verify: passed · systems: picked from list · request: submitted for approval
Why it matters
Turning an Account Back On Is an Access Decision.
Who turned an account back on, why, and on which systems belongs on the record.
What an enable needs
The person's disabled accounts, the systems to turn back on, a time, and a justification, routed through the approval workflow set up for each system.
What goes wrong by hand
Turning accounts back on by hand, system by system, leaves no request, no approval record and no activity-log entry to show who asked and why.
What Enable Account does
It lists the person's connected systems, all selected to start, and enables only the ones left selected, on each system whose connector supports enabling.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether any account is enabled this month or not. Pay Per Identity Action™ charges only for completed account enables.
The Action
How Enable Account Runs
On the web, Enable Account walks through these screens. In Avabot and MCP you verify, name the person, pick systems from the list, give a justification and confirm the read-back.
Verify in Avabot or MCP
Avabot and MCP only. Enable Account starts with identity verification in the conversation, with the methods your policy already allows, such as security questions, authenticator codes, PingID push or the Identity Challenge Card. On the web there is no extra check beyond your sign-in. By default, Enable Account does not need a fresh verification.
Identity Verification (Avabot and MCP)
Select the User
Pick the system (a Domain list appears when there is more than one) and search for the person: someone you are authorized to request for. You can't enable your own account. Workflow admins are then asked "Would you like to use workflow?"
Set the Time and Justification
Choose Enable Now or a date and time, and enter a Justification. A workflow admin who skips workflow skips this step.
Pick the Systems
The person's systems are listed, all selected to start. Leave selected only the ones to enable.
Continue
Choose Continue to submit. The request is recorded in Request History with a Request ID and goes through the Lifecycle Management approval workflow for each selected system. A workflow admin with Account Terminator rights who skips workflow enables the account right away, with no request, and sees a result for each system.
Approval point
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Enable Account always files an approval request that runs as soon as it is approved: there is no scheduling and no way to skip approval.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An account enable completes when the person's selected accounts are enabled, after approval at the chosen time, on each system whose connector supports enabling. A workflow admin who skips workflow enables them at once, with no request and a result for each system. One completed account enable = one Secure Outcome.
Evidence
- A Request ID in Request History (filter Enable Account, PDF or Excel export)
- An activity-log entry
- The request in approvers' pending lists
- A result for each system, when a workflow admin skips workflow
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Every Request Recorded
Requests land in Request History, ready to review and export.
Pay Per Identity Action™
Pay per Completed Account Enable
Pay per completed account enable. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Enable Account, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed account enables only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | Once approved, the selected accounts are enabled at the chosen time, on each system that supports enabling |
| Evidence | Silent failures and missing audit trails | A Request ID in Request History and an activity-log entry |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems Enable Account Touches
Enable Account turns the person's accounts back on in the connected systems you select, such as Active Directory, Entra ID, LDAP directories, Okta and other applications connected through connectors, wherever the connector supports enabling.
- LDAP
- Okta
- Microsoft
- Active Directory and Entra ID accounts, through their connectors.
- Other Systems
- LDAP directories, Okta and other applications connected through connectors, where the connector supports enabling.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Is Enable Account the same as unlocking a locked account?
No. Enable turns a disabled account back on. An account locked by failed sign-ins is handled by Unlock Account.
Can I choose which systems get re-enabled?
Yes. The person's connected systems are listed, and only the ones left selected are enabled.
Can someone re-enable their own account?
No. Nobody can enable, disable or delete their own account.
Can I schedule an enable for a later date?
Yes, in the web app: choose a date and time instead of Enable Now. Avabot always submits a request that runs as soon as it is approved.
Does Avatier provide AI-driven compliance reporting?
Yes. Avatier turns continuous identity and access data into audit-ready reports on demand, using AI to assemble who has access to what, what changed, and who approved it, mapped to the controls auditors expect. Instead of a manual evidence scramble before each audit, you generate plain-language, exportable reports covering SOC 2 Type II and ISO 27001, plus the evidence needs associated with NIST, SOX, HIPAA, and GDPR.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Enable Account
You've Automated the System. Now Secure the Lifecycle.
Pick the systems, give a reason, and each enable request is recorded in Request History with a Request ID.